Open-source atomic malware analysis

Analyze another

ef2c931ffae20504ccdcf8ffb448f8f469004c67cffd8cd7c211f18bcd0b41ab.unknown

KOTLIN
Verdict: SUSPICIOUS
SHA256: ef2c931ffae20504ccdcf8ffb448f8f469004c67cffd8cd7c211f18bcd0b41ab
Mal-ecule
O(Ca)H(Cm)
Size 591 B download
First seen 95 days ago
Analyzed 95 days ago

Objectives

suspicious severity, 72% confident.
credential-access/phishing JavaScript redirect via window.location assignment
component severity, 86% confident.
credential-access/cloud Regex component marker
component severity, 70% confident.
supply-chain/metadata-anomaly/package Small file under 5KB
component severity, 94% confident.
supply-chain/recon-exfil Regex component marker

Micro-behaviors

notable severity, 86% confident.
communications/ip Hardcoded external IPv4 address
baseline severity, 90% confident.
communications/http HTTPS protocol prefix
component severity, 90% confident.
communications/http/url Localhost or IP literal string

Metadata

baseline severity, 100% confident.
lang javascript code embedded in string
component severity, 80% confident.
package Short sidecar-sized source

Identity

SHA-256 ef2c931ffae20504ccdcf8ffb448f8f469004c67cffd8cd7c211f18bcd0b41ab
Filename ef2c931ffae20504ccdcf8ffb448f8f469004c67cffd8cd7c211f18bcd0b41ab.unknown

Origin

Source harvest

Timeline

First seen 16 May 2026 08:00 UTC
First analyzed 16 May 2026 18:10 UTC
Last analyzed 16 May 2026 18:10 UTC
Last updated 18 May 2026 06:58 UTC

Labeling

Label bad
Label source harvest
Traits version 529a0